8_dynamic_continued.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

    <name>Dynamic analysis SRE (cont.)</name>
    <author>Z. Cliffe Schreuders</author>
    <description>
      # Introduction
      Building upon the skills acquired in the previous lab, this hands-on debugging session takes your expertise to the next level with a fresh set of challenges.These new exercises further enhance your dynamic analysis capabilities using the GNU Debugger (GDB). In the world of reverse engineering and cybersecurity, debugging is an indispensable skill, particularly when the source code remains elusive. This lab provides the ideal platform to fortify your skills by introducing unique challenges, each designed to push the boundaries of your GDB proficiency.

      You'll set breakpoints, scrutinize register values, and decipher assembly instructions to uncover concealed passwords and flags. For example, in the "XorStr" challenge, you'll leverage GDB to identify an XOR mask and use it to decrypt a string, while "StaticInt" will have you focusing on EAX values and local variables to print the flag. By the conclusion of this lab, you will have cemented your debugging abilities and effectively surmounted eight new challenges, solidifying your expertise in dynamic analysis for situations where source code accessibility is restricted.

      In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the flag.
    </description>
    <lab_sheet_url>https://docs.google.com/document/d/11A7tZppId1pxbcclZDPr6e-zwWPKqPnJMgyAtcARR2s/edit?usp=sharing</lab_sheet_url>

    <type>ctf-lab</type>
    <type>lab-sheet</type>
    <difficulty>intermediate</difficulty>

    <CyBOK KA="MAT" topic="Malware Analysis">
        <keyword>analysis techniques</keyword>
        <keyword>analysis environments</keyword>
        <keyword>DYNAMIC ANALYSIS</keyword>
    </CyBOK>

    <video>
        <title>Dynamic Analysis and Debugging</title>
        <by>Thalita Vergilio</by>
        <url>https://youtu.be/pExTbDVt0Gw</url>
        <type>lecture-prerecorded</type>
        <CyBOK KA="MAT" topic="Malware Analysis">
            <keyword>analysis techniques</keyword>
            <keyword>analysis environments</keyword>
            <keyword>DYNAMIC ANALYSIS</keyword>
        </CyBOK>
    </video>

    <system>
        <system_name>metactf</system_name>
        <base distro="Debian 12" type="desktop" name="KDE"/>

        <utility module_path=".*/reversing_tools"/>
        <utility module_path=".*/ghidra"/>

        <utility module_path=".*/parameterised_accounts">
            <input into="accounts" into_datastore="account">
                <generator type="account">
                    <input into="username">
                        <generator type="random_sanitised_word">
                            <input into="wordlist">
                                <value>mythical_creatures</value>
                            </input>
                        </generator>
                    </input>
                    <input into="password">
                        <value>tiaspbiqe2r</value>
                    </input>
                    <input into="super_user">
                        <value>false</value>
                    </input>
                </generator>
            </input>
        </utility>


        <utility module_path=".*/kde_minimal">
            <input into="autologin_user">
                <datastore access="0" access_json="['username']">account</datastore>
            </input>
            <input into="accounts">
                <datastore>account</datastore>
            </input>
            <input into="autostart_konsole">
                <value>true</value>
            </input>
        </utility>
        <utility module_path=".*/handy_cli_tools"/>
        <utility module_path=".*/hash_tools"/>

        <utility module_path=".*/metactf">
            <input into="challenge_list">
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_csp/Ch3.1-3.5/Ch3_05_XorLong</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_csp/Ch3.1-3.5/Ch3_05_XorStr</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_csp/Ch3.6-3.7/Ch3_07_SegvBacktrace</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_csp/Ch3.7-3.9/Ch3_08_2DArrays</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_malware/Ch01-08/Ch08Dbg_InputFormat</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_malware/Ch01-08/Ch08Dbg_StaticInt</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_malware/Ch01-08/Ch08Dbg_StaticRE</value>
                    </input>
                </generator>
                <generator type="metactf_challenge">
                    <input into="challenge_path">
                        <value>src_malware/Ch01-08/Ch08Dbg_StaticStrcmp</value>
                    </input>
                </generator>
            </input>
            <input into="account">
                <datastore>account</datastore>
            </input>
        </utility>

        <network type="private_network" range="dhcp"/>
        <input into_datastore="spoiler_admin_pass">
            <generator type="strong_password_generator"/>
        </input>
        <build type="cleanup">
            <input into="root_password">
                <datastore>spoiler_admin_pass</datastore>
            </input>
        </build>
      </system>

</scenario>